What is the CVSS score of CVE-2026-45537?

CVE-2026-45537 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of OpenSIPS are affected by CVE-2026-45537?

OpenSIPS SIP server versions prior to 3.6.6 and 4.0.0-rc1 contain a critical memory corruption vulnerability allowing unauthenticated remote attackers to disrupt call routing and service availability…

How to fix or mitigate CVE-2026-45537?

Within 24 hours: identify all deployed OpenSIPS instances and document exact versions, then review routing scripts to determine if construct_uri() processes untrusted SIP URI usernames-if present, flag as exploitable. Within 7 days: restrict vulnerable systems to trusted SIP network access only, implement strict input validation limiting SIP URI usernames to 512 bytes maximum, and monitor logs for buffer overflow patterns or unexplained routing changes. Within 30 days: upgrade to OpenSIPS 3.6.6, 4.0.0-rc1, or later when available; for systems unable to upgrade immediately, deploy a SIP proxy upstream to validate and truncate oversized SIP URI usernames before reaching OpenSIPS.

OpenSIPS CVE-2026-45537

CRITICAL

Classic Buffer Overflow (CWE-120)

2026-08-04 GitHub_M

Buffer Overflow Opensips

9.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

7.4 HIGH

Network-reachable and unauthenticated (AV:N/PR:N), but AC:H because exploitation depends on a non-default script path calling construct_uri() on untrusted input; no confidentiality impact (C:N), integrity/availability high from deterministic global corruption.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Aug 05, 2026 - 01:27 vuln.today

Analysis Generated

Aug 05, 2026 - 01:27 vuln.today

CVE Published

Aug 04, 2026 - 22:48 cve.org

CRITICAL 9.1

DescriptionCVE.org

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username, domain, port, params) into a fixed 1024-byte global BSS buffer without any bounds checking. When a routing script calls construct_uri() with an attacker-controlled username, a combined component length exceeding 1024 bytes overflows the buffer, corrupting adjacent global data with attacker-controlled content. The overflow reaches disable_503_translation, a global flag controlling SIP 503 response handling, allowing an attacker to deterministically set the flag via the URI username and alter the server's routing behavior for subsequent messages. Because the same buffer is shared with contact_builder(), the overflow also corrupts that function's data, and without a memory sanitizer the adjacent globals are silently overwritten on every request containing a long username. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

AnalysisAI

Memory corruption in the OpenSIPS SIP server (versions prior to 3.6.6 and 4.0.0-rc1) lets remote attackers overflow a fixed 1024-byte global buffer via an oversized SIP URI username, deterministically corrupting adjacent global state such as the disable_503_translation flag and altering the server's routing behavior for subsequent messages. Exploitation requires that the deployed routing script pass an attacker-controlled username into construct_uri(); where that pattern exists, the flaw affects integrity and availability without authentication. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.

Technical ContextAI

OpenSIPS is a high-performance C-based SIP proxy/server used to route VoIP signaling. The root cause is CWE-120 (Classic Buffer Overflow / unbounded copy without size check): the construct_uri() function in msg_translator.c concatenates protocol, username, domain, port and params into a fixed 1024-byte global BSS buffer with no length validation. Because the buffer lives in the BSS segment alongside other module globals - including disable_503_translation and data shared with contact_builder() - an over-length concatenation writes attacker-controlled bytes past the buffer boundary into neighboring static variables rather than the stack, giving a controllable overwrite of specific global flags on every request carrying a long username. CPE cpe:2.3:a:opensips:opensips confirms the affected product is the OpenSIPS application itself.

RemediationAI

Vendor-released patch: upgrade to OpenSIPS 3.6.6 (stable) or 4.0.0-rc1, per advisory GHSA-v7h4-fwrc-c66v (https://github.com/OpenSIPS/opensips/security/advisories/GHSA-v7h4-fwrc-c66v); the fix adds an explicit total-length check in construct_uri() that rejects any concatenation exceeding MAX_URI_LEN before writing. If immediate patching is not possible, apply compensating controls in the routing script: audit for and remove or guard any construct_uri() call that receives untrusted username input, and constrain username length by validating or truncating $fU/$rU (e.g. reject requests whose username exceeds a safe bound) before URI construction - the trade-off is that legitimate long-but-valid usernames may be dropped. Additionally restrict SIP signaling exposure at the network edge (allowlist trusted SIP peers, place the proxy behind an SBC/firewall) to limit which senders can reach the vulnerable script path, accepting reduced openness for federated/anonymous SIP scenarios. Cite the two upstream commits (4d23613 and 5f103ef) when validating that your build includes the bounds check.